CVE-2026-111701Published
OtterMind Nubase through 0.1.4 Missing Authentication in Storage Object API
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-111701 · Microsoft / collected KEV context
cve-program · CVE-2026-111701
- https://hackmd.io/@hieuPenguinnn/nubase-storage-private-object-unauth-download
- https://github.com/OtterMind/Nubase/blob/v0.1.4/src/main/java/ai/nubase/common/multitenancy/UnifiedMultiTenancyFilter.java#L363-L379
- https://github.com/OtterMind/Nubase/blob/v0.1.4/src/main/java/ai/nubase/auth/controller/storage/StorageObjectReadController.java#L68-L74
- https://github.com/OtterMind/Nubase/blob/v0.1.4/src/main/java/ai/nubase/auth/service/StorageService.java#L176-L200
- https://www.vulncheck.com/advisories/ottermind-nubase-through-0.1.4-missing-authentication-in-storage-object-api
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.